CWE-862Vulnerability type
WordPress Missing Authorization vulnerabilities (page 1245)
AJAX and REST handlers without capability checks, exposing privileged actions to subscribers or anonymous visitors.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.5Authenticated Stored Cross-Site Scripting
iQ Block Country
≤1.2.11Update to 1.2.12
- Medium6.4Unprotected REST-API to Email Injection
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.5.7Update to 3.5.8
- Medium6.5Unprotected REST-API to Sensitive Information Disclosure
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.5.7Update to 3.5.8
- High7.5Arbitrary User Password Reset
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory
≤2.6.2Update to 2.6.3
- Medium4.8Admin+ Stored Cross-Site Scripting
Cookie Bar
≤1.8.8Update to 1.8.9
- Medium5.4Cross-Site Scripting
Video Player for YouTube – Embed Videos Your Visitors Will Love to Watch
<1.4Update to 1.4
- Medium5.4Contributor+ Stored Cross-Site Scripting
Easy Media Download
≤1.1.5Update to 1.1.7
- Medium5.8Open Relay and Server-Side Request Forgery
Telefication
≤1.8.0No patch available
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Responsive WordPress Slider
≤2.2.0No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Special Text Boxes
≤5.9.109Update to 5.9.110
- High8.8Cross-Site Request Forgery
jQuery Reply to Comment
≤1.31No patch available
- Medium4.8Vimeo and YouTube Gallery < 1.1.5 - Stored Cross-Site Scripting
Video Gallery – Vimeo and YouTube Gallery
<1.1.5Update to 1.1.5
- High7.2Authenticated (Admin+) SQL Injection
Game Server Status
≤1.0No patch available
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
St-Daily-Tip
≤4.7No patch available
- Medium6.1Unauthenticated Stored Cross-Site Scripting
Frontend Uploader
≤1.3.2No patch available
- Medium5.4Authenticated (Author+) Stored Cross-Site Scripting
WP HTML Author Bio
≤1.2.0No patch available
- High7.5Unauthenticated Arbitrary Post Deletion
WP DSGVO Tools (GDPR)
≤3.1.23Update to 3.1.24
- Medium4.8Stored Cross-Site Scripting
Request a Quote – Quote Forms for Any WordPress Site
<2.3.5Update to 2.3.5
- Medium6.1Reflected Cross-Site Scripting
Popup Builder & Popup Maker for WordPress – OptinMonster Email Marketing and Lead Generation
≤2.6.0Update to 2.6.1
- Medium5.4Cross-Site Scripting
StreamCast – bring live radio to your site with a sleek player
<2.1.1Update to 2.1.1
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
微信打赏（Wechat Reward）
≤1.7No patch available
- Medium4.8Authenticated Stored Cross-Site Scripting
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.1.3Update to 4.1.3.1
- Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting
Sociable
≤4.3.4.1No patch available
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting
Polo Video Gallery – Best wordpress video gallery plugin
≤1.2No patch available
- Medium5.5Admin+ Stored Cross-Site Scripting
Tutor LMS – eLearning and online course solution
<1.9.9Update to 1.9.9
- Medium6.5Cross-Site Request Forgery
One User Avatar | User Profile Picture
<2.3.7Update to 2.3.7
- Medium5.4Missing Authorization
Catch Themes Demo Import
<1.6Update to 1.6
- High8.8Cross-Site Request Forgery to Remote Code Execution and/or Cross-Site Scripting
Scroll Baner
≤1.0No patch available
- Medium6.4Cross-Site Scripting
Easy Feeds for X/Twitter – keep your site fresh with live social posts
<1.2Update to 1.2
- Medium5.4Stored Cross-Site Scripting
One User Avatar | User Profile Picture
<2.3.7Update to 2.3.7